A zero-day vulnerability has been discovered in a globally used brand of hardware server that allows hackers to gain access to affected IT systems. Which of the following is MOST likely to change as…

Control effectiveness might *decrease* due to the vulnerability, but the *discovery* itself first impacts the likelihood of an attack exploiting it, before specific control failures are assessed.

Risk appetite is a strategic decision about how much risk an organization is willing to accept, which is unlikely to change immediately due to a single vulnerability discovery.

A zero-day vulnerability, by definition, is a newly discovered flaw with no existing patch, making systems highly susceptible to exploitation. Its discovery in widely used hardware means the probability (likelihood) of a successful attack against affected systems dramatically increases, as attackers now have a known, unmitigated path to compromise.

A Key Risk Indicator (KRI) is a metric used to monitor risk; while this event might *influence* or *trigger* an update to KRIs, the KRI itself doesn't inherently *change* as a direct result of the vulnerability discovery, rather it *reflects* changes in risk likelihood.